arken-protocol
Middleware that authenticates requests without passwords using DID signatures
What does it do?
When an unsigned request arrives, the server returns a 401 response with a one-time nonce. The client signs the nonce with a private key, places it in the Authorization header, and sends the request again. The middleware recovers the address from the signature, compares it with the address in the DID, and returns the authenticated DID. The nonce is kept in memory for 60 seconds and is consumed after one use. Installation currently requires a Rust toolchain to build a native cryptography library.
Key features
- Return a 401 response with a one-time nonce for unsigned requests
- Verify requests that clients resend with a signature
- Compare the address recovered from the signature with the address in the DID
- Pass the authenticated DID to the application
- Keep the nonce in memory for 60 seconds and consume it after use